We study the use case within the framework of discrete-time dynamical systems. Specifically, we formulate the problem of finding an optimal defender policy as an (optimal) multiple stopping problem. In this formulation, the defender can take a finite number of stops. Each stop is associated with a defensive action and the objective is to decide the optimal times when to stop. This approach gives us insight into the structure of optimal defender policies through the theory of dynamic programming and optimal stopping [1]}. In particular, we show that an optimal threshold policy exists that can be efficiently computed and implemented. Other related research on automated intrusion prevention, in contrast, do not demonstrate structural properties of optimal policies [2]}, [3]}, [4]}, [5]}, [6]}, [7]}, [8]}, [9]}, [10]}, [11]}.
